Budget for an executive working session, not a keynote

Cost of a Cybersecurity Tabletop Exercise

An executive tabletop is a working session for the people who must make decisions during an incident. Use this guide to define the scope, compare proposals on the same basis, and discuss a tailored exercise with Mark Lynd.

Request a Tabletop Quote → What to Include in Your Brief

What Determines the Cost?

Cybersecurity tabletop exercise cost depends on the scenario, preparation, number of participants, delivery format, and after-action work. Ask for an itemized quote that separates facilitation, travel, written findings, and follow-up support. A scoped proposal is more useful than a headline fee for a different exercise.

Compare Exercise Formats, Not Just Fees

A shorter session is not automatically a smaller engagement. Scenario research, preparation with leadership, and the depth of follow-up can matter as much as the time in the room. These are scoping options to discuss, not fixed-price packages.

Focused Executive Exercise

A single scenario and a defined leadership group. Compare preparation time, participant briefing, facilitation, and the level of written findings.

Best for: Testing one decision path or a first executive tabletop

Multi-Vector Exercise

Linked scenarios such as ransomware, AI-enabled impersonation, or disruption across suppliers. Ask how injects, cross-functional decisions, and a debrief will be designed.

Best for: Teams testing coordination across several functions

Multi-Team or Multi-Day Program

A broader program involving several teams or organizations. Scope coordination, scenario dependencies, reporting, travel, and follow-up as distinct line items.

Best for: Complex operating environments and deeper follow-through

What to Include in Your Tabletop Brief

  1. The decision you want to test. Examples include incident command, containment authority, recovery priorities, and executive communication.
  2. The people in the room. Approximate participant count, roles, and whether multiple teams or organizations are involved.
  3. The scenario and format. High-level scenario focus, preferred date or window, virtual or on-site delivery, and location.
  4. The outputs you need. Debrief, written findings, remediation owners, a board summary, or follow-up sessions.
  5. The commercial boundaries. Budget range if known, travel expectations, procurement requirements, and what should be optional.

Keep the initial brief high-level. Do not send sensitive incident details, credentials, or confidential system information through the public inquiry form.

Discuss Your Exercise →

An Executive Tabletop Should Test Decisions

✓

Decision ownership. Identify who can declare an incident, approve containment, authorize recovery, and brief the board.

✓

Cross-functional coordination. Bring technology, operations, legal, communications, finance, and leadership into the same scenario.

✓

Evidence and follow-through. Agree how observations, decision gaps, remediation owners, and follow-up work will be documented.

✓

Practitioner context. Mark is a 5x CEO/CIO/CISO. His tabletop work is grounded in The 72-Hour IR Executive Playbook.

Looking for a conference presentation rather than a facilitated exercise? Explore Mark's speaking topics and formats.

Tabletop Budgeting Questions

How much does a cybersecurity tabletop exercise cost?
The fee depends on the work being scoped. Preparation, scenario complexity, participant count, delivery format, and after-action depth all affect the quote. Request a proposal for your actual team and objectives rather than comparing headline rates for unlike exercises.
What should a tabletop exercise quote include?
Ask the facilitator to specify discovery and preparation, custom scenario design, facilitation time, the debrief, written findings, follow-up sessions, and any travel costs. Confirm which items are included and which are optional before agreeing to the work.
Is a tabletop exercise the same as a keynote?
No. A keynote presents ideas to an audience. A tabletop asks the participating team to make decisions in a scenario and examines how those decisions are coordinated. Use the advisory inquiry route for a facilitated exercise, or the speaking inquiry route for an event presentation.
What information is needed for a tailored quote?
Share the organization type, approximate participant count and roles, preferred date or window, virtual or on-site format and location, scenario focus, and desired outputs. A high-level brief is enough to start; do not include confidential incident details or sensitive system information in the public form.
Can an exercise support governance or insurance preparation?
An exercise can identify decision gaps and provide material for follow-up planning. Agree the required evidence and reporting with your own legal, risk, or insurance advisers. An exercise does not guarantee compliance, insurance coverage, or a premium reduction.

Related advisory resources

Executive Advisory & Workshops · Tabletop Exercise Facilitator · The 72-Hour IR Executive Playbook